{"id":7490,"date":"2018-05-29T10:41:45","date_gmt":"2018-05-29T02:41:45","guid":{"rendered":"http:\/\/rmohan.com\/?p=7490"},"modified":"2018-05-29T10:41:45","modified_gmt":"2018-05-29T02:41:45","slug":"how-to-install-fail2ban-in-rhel-6-7","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=7490","title":{"rendered":"How to install Fail2ban in rhel 6 & 7"},"content":{"rendered":"

How to install Fail2ban in rhel 6 & 7<\/h3>\n
\n
<\/div>\n<\/div>\n
\n
What is fail2ban?<\/b><\/p>\n

Fail2ban works by scanning and monitoring log files for selected entries then bans IPs that show the malicious signs like too many password failures, seeking for exploits, etc.<\/p>\n


\n1. Install Fail2Ban<\/b><\/p>\n

For RHEL 6<\/p>\n

rpm -Uvh http:\/\/dl.fedoraproject.org\/pub\/epel\/6\/x86_64\/epel-release-6-8.noarch.rpm<\/p>\n

For RHEL 7<\/p>\n

rpm -Uvh http:\/\/dl.fedoraproject.org\/pub\/epel\/7\/x86_64\/Packages\/e\/epel-release-7-11.noarch.rpm<\/p>\n

yum install fail2ban<\/b><\/p>\n

2. Copy the Configuration File<\/b><\/p>\n

The default fail2ban configuration file is located at \/etc\/fail2ban\/jail.conf. The configuration work should not be done in that file, since it can be modified by package upgrades, but rather copy it so that we can make our changes safely.<\/p>\n

We need to copy this to a file called jail.local for fail2ban to find it:<\/p>\n


\ncp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/b><\/p>\n


\n3. Configure defaults in Jail.Local<\/b><\/p>\n

The first section of defaults covers the basic rules that fail2ban will follow to all services enabled for fail2ban that are not overridden in the service’s own section.. If you want to set up more nuanced protection for your server, you can customize the details in each section.<\/p>\n

You can see the default section below.<\/p>\n

[DEFAULT]<\/p>\n

# “ignoreip” can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
\n# ban a host which matches an address in this list. Several addresses can be
\n# defined using space separator.
\nignoreip = 127.0.0.1<\/p>\n

# “bantime” is the number of seconds that a host is banned.
\nbantime\u00a0 = 3600<\/p>\n

# A host is banned if it has generated “maxretry” during the last “findtime”
\n# seconds.
\nfindtime\u00a0 = 600<\/p>\n

# “maxretry” is the number of failures before a host get banned.
\nmaxretry = 3<\/p>\n

4. Add a jail file to protect SSH<\/b><\/p>\n

Although you can add this parameters in the global jail.local file, it is a good practice to create seperate jail files for each of the services we want to protect with Fail2Ban.<\/p>\n

So lets create a new jail for SSH with the vi editor.<\/p>\n

vi \/etc\/fail2ban\/jail.d\/sshd.local<\/b><\/p>\n

In the above file, add the following lines of code:<\/p>\n

[sshd]
\nenabled = true
\nport = ssh
\naction = iptables-multiport
\nlogpath = \/var\/log\/secure
\nmaxretry = 3
\nbantime = 3600<\/p>\n

5. Restart Fail2Ban<\/b><\/p>\n

service fail2ban restart<\/b><\/p>\n

iptables -L<\/b><\/p>\n

Check Fail2Ban Status<\/p>\n

Use fail2ban-client command to query the overall status of the Fail2Ban jails.<\/p>\n


\nfail2ban-client status<\/b><\/p>\n

You can also query a specific jail status using the following command:<\/p>\n

fail2ban-client status sshd<\/b><\/p>\n

Manually Unban IP Banned by Fail2Ban<\/p>\n

If for some reason you want to grant access to an IP that it is banned, use the following expression to manually unban an IP address, banned by fail2ban:
\n
\nfail2ban-client set JAIL unbanip IP<\/b><\/p>\n

eg. Unban IP 192.168.1.101, that was banned according to [ssh-iptables] jail:<\/p>\n

fail2ban-client set sshd unbanip 192.168.1.101<\/b><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

How to install Fail2ban in rhel 6 & 7 What is fail2ban?<\/p>\n

Fail2ban works by scanning and monitoring log files for selected entries then bans IPs that show the malicious signs like too many password failures, seeking for exploits, etc.<\/p>\n

1. Install Fail2Ban<\/p>\n

For RHEL 6<\/p>\n

rpm -Uvh http:\/\/dl.fedoraproject.org\/pub\/epel\/6\/x86_64\/epel-release-6-8.noarch.rpm<\/p>\n

For RHEL 7<\/p>\n

rpm -Uvh […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[73],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7490"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7490"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7490\/revisions"}],"predecessor-version":[{"id":7491,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7490\/revisions\/7491"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7490"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7490"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7490"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}